Cyber-Physical Security of Virtual Power Plants: A Survey

Virtual power plants (VPPs) integrates distributed generation, storage systems, and load under a common control and market framework. Although the VPP concept brings improved flexibility and new services to the utility, it substantially endangers the grid due to the large cyber-physical attack surface. This paper investigates the cyber-physical security of VPPs in modern power systems. First, the structure of VPPs is outlined, including main components, control hierarchies, communication layers, and ancillary services. Further, the cyber and physical vulnerabilities are mapped across different layers of the VPP. This mapping further leads to a structured taxonomy of attacks common in VPP context. Following the vulnerability analysis, the paper looks into the different defense mechanisms relevant to VPP-coordinated distributed energy systems (DESs), in categorization of prevention, detection and isolation, and resilient control. The comprehensive investigation highlights the pressing need for the development of robust, co-designed security and resilience strategies across all layers of VPPs to safeguard their operations against evolving cyber-physical risk, which remains to be a significant gap in the VPP study.